Extracted

• • Target
    4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
  • Size 70KB
  • SHA256 4b9d898379e5dd1d260c1706aa04aa8270994835a523bb83695062d92c830311
  • MD5 109adf5a32829b151d536e30a81ee96b
  • SHA1 dc23006a97e7d5bc34eedec563432e63ed6a226a
  • SHA512 74e7fb13e195dcf6b8ed0f40c034925c3762b2e0c43c8faede99ce79a4b07966ff5336769db3f9f5bb4c0478cefc879d59b43d5ded5bda3e75d19bd0a1e9e9e5
  • SSDEEP 1536:QeYZA06UMG73jWw9o5zeS6LQR9bAayaIMbckM6mfOWcNFOfab:QfZxfMGTFXS6LQR9bAaZbfsfOPMab
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  xwormpersistencerattrojan

  • Detect Xworm Payload

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2